N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-g5cg-8x5w-7jpm

GHSA-g5cg-8x5w-7jpm: OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

Summary

Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

Current Maintainer Triage

Status: open
Normalized severity: Critical

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

a30214a624946fc5c85c9558a27c1580172374fd — 2026-03-31T09:06:51+09:00

OpenClaw thanks @AntAISecurityLab for reporting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-g5cg-8x5w-7jpm

GHSA-g5cg-8x5w-7jpm:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openclaw	npm	<= 2026.3.28	2026.3.31

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows for a privilege escalation bypass within the OpenClaw platform. The root cause is that heartbeat executions, particularly those triggered by exec-event completions, were inheriting the owner context of the session they were associated with. This allowed for unauthorized access to owner-only tools and commands.

The analysis of the patch commit a30214a624946fc5c85c9558a27c1580172374fd reveals two key functions involved in this vulnerability:

runHeartbeatOnce in src/infra/heartbeat-runner.ts: This function initiates the heartbeat process. The patch modifies it to add a ForceSenderIsOwnerFalse: true flag to the message context (MsgContext) when the heartbeat is triggered by an exec-event (hasExecCompletion is true). This indicates that this function was the source of the vulnerable context that lacked the necessary restrictions.
resolveCommandAuthorization in src/auto-reply/command-auth.ts: This function is responsible for checking if a command is authorized. The patch modifies this function to check for the newly added ForceSenderIsOwnerFalse flag. If this flag is true, it forces the senderIsOwner check to be false, thereby preventing the privilege escalation. Before the patch, this function would incorrectly determine the sender as an owner based on the inherited context from the heartbeat.

Therefore, during exploitation, runHeartbeatOnce would be called to trigger a heartbeat, and resolveCommandAuthorization would subsequently be called with a crafted context that bypasses the intended authorization checks.

Vulnerable functions

resolveCommandAuthorization

src/auto-reply/command-auth.ts

This function determines if the sender of a command has owner privileges. The vulnerability lies in the fact that it could incorrectly determine that the sender is an owner in the context of a heartbeat execution. The patch introduces a `ForceSenderIsOwnerFalse` flag in the context to explicitly prevent this privilege escalation.

runHeartbeatOnce

src/infra/heartbeat-runner.ts

This function is responsible for executing heartbeats. The vulnerability is triggered here because this function creates the execution context for the heartbeat. Before the patch, it did not set any flag to prevent owner privilege inheritance. The patch modifies this function to set `ForceSenderIsOwnerFalse` to `true` when the heartbeat is triggered by an `exec-event`, thus preventing the downstream `resolveCommandAuthorization` function from incorrectly granting owner privileges.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.